Yes — deliberately accessing someone else's account, device, or network without their permission is illegal, even if you know the password, and even if the person is your spouse, partner, or ex. California prosecutes unauthorized access under Penal Code § 502 (the Comprehensive Computer Data Access and Fraud Act), and federal prosecutors use the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. "Hacking" in the legal sense does not require technical skill — simply logging in without authorization is enough. This guide from The Bulldog Law's criminal defense team explains what the law forbids, the penalties, the spouse-and-password myths that get people charged, the defenses — and what to do if someone accessed your account.

Is It Illegal to Log Into Someone's Account Without Permission?

Yes. Knowingly logging into another person's account without authorization is a crime in California and under federal law — regardless of how you got the password and regardless of whether you "did anything" once inside. The offense is the unauthorized access itself. Reading messages, checking a balance, or just looking around all qualify; copying, deleting, or using the data adds separate and more serious charges. It also does not matter whose device you used, or that the account "was just sitting open" — using an open session you know isn't yours to explore someone's private account is still access without permission. Courts treat digital accounts the way they treat locked rooms: entering without consent is the violation; what you do inside determines how much worse it gets.

What Laws Make Accessing Someone Else's Account Illegal?

Three main statutes cover unauthorized account access — one California, two federal. Which one applies depends on what was accessed and how:

California Penal Code § 502 — the Comprehensive Computer Data Access and Fraud Act makes it a crime to knowingly access a computer, computer system, or data without permission — including logging into another person's online accounts. The firm's full guide to California Penal Code § 502 breaks down each subdivision.

Computer Fraud and Abuse Act (18 U.S.C. § 1030) — the federal anti-hacking statute, covering access "without authorization" to protected computers — which in practice includes virtually anything connected to the internet. Federal charges typically appear when money, interstate conduct, or larger intrusions are involved; see the firm's federal cybercrime defense guide (18 U.S.C. § 1030).

Stored Communications Act (18 U.S.C. § 2701) — a separate federal law criminalizing unauthorized access to stored communications — the statute most often implicated when someone opens another person's email or reads their stored messages. For that specific scenario, see is it illegal to read someone else's email.

Is It Illegal to Hack Into Someone's Social Media Account?

Yes — breaking into someone's Instagram, Facebook, TikTok, or X account is unauthorized access under PC § 502 and the CFAA, and what people do next usually adds charges. Guessing a password, using a saved login, or tricking a password reset all count as "hacking" in the legal sense — no code required. And the follow-on conduct is where cases escalate: posting as the person can be false impersonation under PC § 529.5, using their credentials or personal information can be identity theft under PC § 530.5, and sharing intimate images found inside can be prosecuted as revenge porn under PC § 647. A single angry evening on an ex's account can generate three or four separate counts.

What If You Know the Password — or They Gave It to You Before?

Knowing the password is not permission. Authorization is about consent to this access, now — and consent given once can be revoked. This is the misunderstanding behind a huge share of these cases. A partner who shared a Netflix login did not authorize reading their email. An employee who had credentials for work did not keep authorization after quitting. An ex who never changed a password did not consent to being monitored. Prosecutors charge these cases precisely because the access looks "easy" — the law asks only whether the account owner permitted that access at that time, and "the password still worked" has never been a defense.

Is It Illegal to Go Through Your Spouse's or Partner's Phone or Accounts?

Marriage is not authorization. Logging into a spouse's or partner's private accounts without permission is still unauthorized access — and in divorce and custody disputes it generates criminal exposure, not evidence. These cases cluster around breakups: one partner "checks" the other's email or messages hunting for proof of cheating or hidden money. Beyond § 502, secretly intercepting or recording communications can violate California's wiretapping and eavesdropping laws — including Penal Code § 631 — and evidence obtained this way is routinely excluded in family court while the snooping spouse faces charges. Account-access allegations also appear inside domestic violence cases, where monitoring a partner's accounts can be framed as part of a pattern of abuse or a restraining-order violation. If a relationship is ending, the safe rule is absolute: their accounts are off-limits.

What Are the Penalties for Accessing Someone Else's Account?

California PC § 502 is typically a wobbler — chargeable as a misdemeanor (up to one year in county jail) or a felony (up to three years), with fines that can reach $10,000 — and the account owner can also sue you civilly. Federal CFAA penalties start at up to one year for simple unauthorized access and climb to five years or more where there is financial gain, damage, or repeat conduct; Stored Communications Act violations carry their own federal exposure. Section 502(e) adds a civil right of action, so a criminal case can be followed by a lawsuit for damages and attorney's fees. And because these are fraud-adjacent offenses, convictions ripple outward — professional licenses, security clearances, and immigration status can all be affected.

What If Someone Accessed YOUR Account?

If your account is being used by another person, act in this order: lock them out, preserve the evidence, then use the law — you may have both criminal and civil remedies. The victim-side playbook:

1. Secure the account immediately — change the password, enable two-factor authentication, sign out all sessions/devices, and check recovery emails and phone numbers for changes the intruder made.
2. Preserve evidence before it disappears — screenshot login-alert emails, unfamiliar sessions, sent messages you didn't write, and any changed settings; note dates and times.
3. Use the platform's compromised-account process — every major provider has one; it creates a record and can restore control.
4. Report it — unauthorized access of your accounts is a crime under PC § 502; a police report also protects you if the intruder impersonated you or used your information (identity theft under PC § 530.5).
5. Consider civil action — PC § 502(e) lets victims sue for damages and attorney's fees, and an attorney can send preservation demands before logs are purged.

What Are the Defenses to Unauthorized Access Charges?

These cases turn on one word — authorization — and that is where the defense lives. The recurring strategies: actual consent (the owner authorized this access, and messages or conduct prove it); shared accounts and joint ownership (a genuinely joint account or family device muddies "without permission"); lack of knowledge or intent (§ 502 requires knowing access without permission — auto-saved logins, synced devices, and shared computers create honest-mistake scenarios); identity (login records show an IP or device, not a person — in shared households, proving who was at the keyboard is the prosecution's problem); and overreach (both § 502 and the CFAA have been cut back by courts rejecting expansive "exceeded authorization" theories). Early defense work — before charging decisions — resolves many of these cases quietly.

Frequently Asked Questions

Is it illegal to log into someone's account if you know the password?

Yes. Knowing the password is not the same as having permission. The crime under California Penal Code § 502 and the federal CFAA is accessing the account without authorization — and authorization means the owner's consent to that access, at that time. A password shared for one purpose, or in the past, does not authorize new snooping, and consent can be revoked at any moment. "The password still worked" is not a defense.

Can you go to jail for hacking someone's account?

Yes. In California, unauthorized access under PC § 502 is typically a wobbler — a misdemeanor carrying up to one year in county jail, or a felony carrying up to three years, plus fines that can reach $10,000 and civil liability to the account owner. Federal CFAA convictions start at up to one year and rise to five years or more where there is financial gain, damage, or repeat conduct. Follow-on conduct — impersonation, identity theft, sharing private images — adds separate counts.

Is it illegal to go through your spouse's phone or email?

Accessing a spouse's or partner's private accounts without permission is still unauthorized access — marriage does not create authorization. In practice these cases arise during divorces and breakups, and they backfire twice: the snooping spouse faces criminal exposure under PC § 502 (and potentially California's wiretapping laws), while the "evidence" gathered is routinely excluded in family court. If accounts or devices are genuinely shared, the analysis is more nuanced — talk to an attorney before acting.

What should I do if someone else is using my account?

Move in this order: (1) change the password, enable two-factor authentication, and sign out all devices; (2) screenshot the evidence — login alerts, unfamiliar sessions, messages you didn't send; (3) run the platform's compromised-account recovery process; (4) report it — unauthorized access of your account is a crime under PC § 502, and a police report protects you if the intruder impersonated you; and (5) ask an attorney about a civil claim — § 502(e) lets victims recover damages and attorney's fees.

Unauthorized access cases are deceptively serious — a password typed in anger can become a felony filing, and a compromised account can upend the victim's life. Whichever side of the login you are on, The Bulldog Law's criminal defense team handles computer-access cases across California and in federal court. For more on your digital rights, see whether police can read your Facebook messages and how police access online data. Call (888) 928-1609 for a free consultation.